From df6f913d95a2556f232670a591f672fb5f5ffc9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=2E=20Nam=C3=A8che?= <sebastien@itik.fr>
Date: Thu, 5 Feb 2026 09:54:03 +0300
Subject: [PATCH] doc

---
 seb4itik/byow/README.md                       | 24 +++++++++++++++++--
 .../byow/roles/caddy/templates/coraza.conf    |  1 +
 seb4itik/byow/roles/caddy/vars/main.yml       |  2 +-
 3 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/seb4itik/byow/README.md b/seb4itik/byow/README.md
index d409080..96fecb2 100644
--- a/seb4itik/byow/README.md
+++ b/seb4itik/byow/README.md
@@ -105,18 +105,19 @@ Fonctionnalités déjà implémentées:
 - Collecte des logs via OVH LDP
 - Whitelist
 - Static files et FastCGI pour PHP (NON, par design !)
+- Authorizations (NON, par design !)
 - Rate limit (non distribué)
 - CORS
 
 Urgemment:
 
 - Connexion à consul, ACL consul
-- Active backend checks
-- Faire fonctionner le filtre dict2str via la collection Ansible
 
 Fonctionnalités à ajouter:
 
+- option "api: true" for activating API default settings
 - Rate limiting distribué
+- Antivirus
 - Antibot par:
   - Cookie
   - Captcha
@@ -133,17 +134,24 @@ Fonctionnalités à ajouter:
   - (ip:danmeuk-tor-exit, ua:mitchellkrogza-bad-user-agents)
 - Client cache
 - Proxy cache
+- Random WAF signatures
 - Compression Brotli
 - Reverse scan
 - Robots.txt (DarkVisitors API/Community Lists/Custom URLs/Manual Rules)
 - Gestion des sessions
 - Bad behavior (via Caddy events ?)
 - Authentification
+  - cf. https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
+  - avec vérification force du mot de passe (cf. CdC Essor)
+  - avec test mot de passe moins un caractère
+  - avec test mot de passe comprommis
 - Anti DDoS
 - Greylist
+- HTML Sanitization
 - HTML injection
 - Metrics (Elasticsearch + Metabase)
 - Crowdsec
+- Stream support
 - Caddy as internal CA
 - https://raw.githubusercontent.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker/master/_generator_lists/bad-user-agents.list 
 
@@ -156,6 +164,18 @@ Fonctionnalités à ajouter:
 - [Documentation AWOSP CRS](https://coreruleset.org/docs/)
 - https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x)
 
+- (1) https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
+- (2) https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Cookie_Theft_Mitigation_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
+- https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html
+
 
 ### Installation d'Ansible avec pipx
 
diff --git a/seb4itik/byow/roles/caddy/templates/coraza.conf b/seb4itik/byow/roles/caddy/templates/coraza.conf
index ed7c6fb..9dff9b4 100644
--- a/seb4itik/byow/roles/caddy/templates/coraza.conf
+++ b/seb4itik/byow/roles/caddy/templates/coraza.conf
@@ -1,4 +1,5 @@
 # -- Rule engine initialization ----------------------------------------------
+# See: https://coraza.io/docs/seclang/directives/
 
 # Enable Coraza, attaching it to every transaction. Use detection
 # only to start with, because that minimises the chances of post-installation
diff --git a/seb4itik/byow/roles/caddy/vars/main.yml b/seb4itik/byow/roles/caddy/vars/main.yml
index b25c637..5887805 100644
--- a/seb4itik/byow/roles/caddy/vars/main.yml
+++ b/seb4itik/byow/roles/caddy/vars/main.yml
@@ -278,7 +278,7 @@ caddy_global_sites_defaults:
 
   # steffenbusch/caddy-bot-barrier
   bot_barrier: false
-  bot_barrier_secret: null     # Required
+  bot_barrier_secret: null    # Required
   bot_barrier_complexity: 18
   bot_barrier_valid_for: "60m"